+1 Using direct download links sounds better to me too. Both curl and wget have curl -o, --output file and wget -O, --output-document=file options to avoid needing to rename the file after downloading it. We can mention these options somewhere in the same places where we already mention that downloads should be verified and how to do so.
John -----Original Message----- From: Steve Lawrence <slawre...@apache.org> Sent: Thursday, December 15, 2022 11:01 AM To: dev@daffodil.apache.org Subject: EXT: Direct download links to releases? For linking to the latest release artifacts on our webpage, we currently use the closer.lua script described here: https://infra.apache.org/release-download-pages.html For example, to download the latest source release, our website links here: https://www.apache.org/dyn/closer.lua/daffodil/3.4.0/src/apache-daffodil-3.4.0-src.zip This goes to an HTML page listing mirrors and verification instructions. Unfortunately, this means that if a user just uses wget/curl to download the link, they will just get an HTML page instead of the actual zip, which can lead to confusion when installation/checksum/gpg verification fails. I know I've done this in the past, and just supported a user that ran into this as well. And I think linking to this HTML page doesn't really provide much benefit anymore. It used to list a number of alternative mirrors, but relatively recently it switched to only listing dlcdn.apache.org, so the CDN automatically determines the best mirror. Additionally, our download page already mentions that downloads should be verified, and links to instructions on how to do so. So this page doesn't really provide any new information. According to first link, we still must use the closer.lua script, but we can add the "action=download" query parameter to automatically redirect to download the file. So for example, the above link would become: https://www.apache.org/dyn/closer.lua/daffodil/3.4.0/src/apache-daffodil-3.4.0-src.zip?action=download An added benefit to this is closer.lua supports archives, so we would no longer need to change the links of previous releases to directly point to the archive URL. For example, this link to an archived release works fine: https://www.apache.org/dyn/closer.lua/daffodil/3.3.0/src/apache-daffodil-3.3.0-src.zip?action=download One downside I see to this is if you wget this URL, the resulting filename includes the query parameter. It's a bit unhelpful since a user would likely need to remove it, but at least they get what they intended. There might also be a wget option to fix this, or if we do go this route, maybe we can suggest to infra a new closer.lua script that has the same behavior but with action=download as the default (e.d. download.lua). Thoughts?
